Vendor Impersonation Payment Inquiry BEC Attack

Initial Email Content

Subject

INVOICE'S DUE/OPEN "UPDATE"

Body

Dear Partner,

‍

We kindly ask that you re-confirm to us the status of our outstanding or
any due payments if there are any, as we currently have to give you an
updated information.

‍

Please get back to us immediately with the total amount that is
outstanding with corresponding due dates and invoices respectively.

‍

If you need any further information, please do not hesitate to contact
me for further assistance.

‍

Thank you for your compliance.

‍

Kinds Regards
[Impersonated Vendor Employee Name] ([Impersonated Vendor Employee Title])
[Impersonated Vendor Company Name]‍

‍

Attack Screenshots

No items found.

Malicious Artifacts

Additional Indicators of Compromise

Type

Description

No items found.

Attack Description

This text-based BEC attack impersonates a vendor/supplier using a spoofed email address, a free webmail account, and a payment inquiry theme to request a fraudulent payment.

Analysis Overview

Type

Business Email Compromise

Tactic

Spoofed Email Address

Free Webmail Account

Goal

Payment Fraud

Impersonated Party

External Party - Vendor/Supplier

Vector

Text-based

Theme

Payment Inquiry

Language